support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. EC-Council
  4. 312-50v13

EC-Council 312-50v13 Exam Actual Questions
Certified Ethical Hacker v13 (Page 20 )

Updated On: 31-Jul-2026
Page 20 of 133
PDF with 1065 Questions

As a Certified Ethical Hacker, you are conducting a footprinting and reconnaissance operation against a target organization. You discover a range of IP addresses associated with the target using the SecurityTrails tool. Now, you need to perform a reverse DNS lookup on these IP addresses to find the associated domain names, as well as determine the nameservers and mail exchange (MX) records.
Which of the following DNSRecon commands would be most effective for this purpose?

  1. dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr
  2. dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk
  3. dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std
  4. dnsrecon -r 162.241.216.0/24 -d example.com -t brt

Answer(s): C

Explanation:

C is correct because it effectively performs a standard DNS enumeration to gather associated domain names, nameservers, and MX records for a specified range of IP addresses.
Firstly, option C ( dnsrecon -r 162.241.216.0/24 -n nsl.example.com -t std ) is the most appropriate command for a comprehensive DNS query. The -r flag specifies a range of IP addresses to query, the -n option allows the specification of a nameserver to be used for the queries, and the -t std indicates a standard enumeration,
which is designed to return essential DNS records, including A, AAAA, MX, and NS records. This combination is ideal for gathering all necessary information.
Option A ( dnsrecon -r 192.168.1.0/24 -n nsl.example.com -t axfr ) targets a private IP range (192.168.x.x), which is typically not reachable from external networks, thus rendering the command ineffective in a reconnaissance operation against a public organization.
Option B ( dnsrecon -r 10.0.0.0/24 -n nsl.example.com -t zonewalk ) similarly engages with another private IP
range (10.x.x.x). Moreover, the -t zonewalk option is geared towards attempting a zone transfer, which is often restricted by DNS servers to prevent unauthorized enumeration, making this option less suitable for general reconnaissance.
Option D ( dnsrecon -r 162.241.216.0/24 -d example.com -t brt ) targets a specific domain rather than an IP range.
The -t brt function is designed to retrieve all subdomains but does not provide a holistic view of all relevant
DNS records associated with the given IP range, thus limiting its effectiveness compared to option C.
In summation, option C stands out as the most effective command due to its broad, general-purpose DNS query capabilities tailored to a defined range of IP addresses, ensuring comprehensive data retrieval for the reconnaissance effort.
References:
https://securitytrails.com/blog/reverse-dns-lookup https://dnsrecon.readthedocs.io/en/latest/ https://www.csoonline.com/article/3626368/ethical-hacking-methods-footprinting-and-recon.html


Reference:

References:
https://securitytrails.com/blog/reverse-dns-lookup https://dnsrecon.readthedocs.io/en/latest/ https://www.csoonline.com/article/3626368/ethical-hacking-methods-footprinting-and-recon.html



You are an ethical hacker tasked with conducting an enumeration of a company's network. Given a Windows Answered Marked for Review 37.6% system with NetBIOS enabled, port 139 open, and file and printer sharing active, you are about to run some nbtstat commands to enumerate NetBIOS names. The company uses IPv6 for its network.
Which of the following actions should you take next?

  1. Switch to an enumeration tool that supports IPv6
  2. Use nbtstat -a followed by the IPv6 address of the target machine
  3. Use nbtstat -c to get the contents of the NetBIOS name cache
  4. Utilize Nmap Scripting Engine (NSE) for NetBIOS enumeration

Answer(s): A

Explanation:

A is correct because switching to an enumeration tool that supports IPv6 is necessary for effective NetBIOS enumeration on a network utilizing IPv6.
Using nbtstat, traditionally designed for IPv4, limits the enumeration capabilities when the target employs IPv6. Although nbtstat is useful for querying NetBIOS over TCP/IP, without robust support for IPv6, the effectiveness of this command diminishes, potentially omitting critical information.
Critical Evaluation of Other Options:
B: Use nbtstat -a followed by the IPv6 address of the target machine: This option is misleading because nbtstat does not support IPv6 addresses directly; attempting to use this command may result in failure to retrieve NetBIOS information, undermining the enumeration efforts.
C: Use nbtstat -c to get the contents of the NetBIOS name cache: While this command retrieves names stored in the local cache, it has no relevance to a remote IPv6-enabled target. Thus, it may yield an empty or irrelevant result, failing to advance the enumeration objectives.
D: Utilize Nmap Scripting Engine (NSE) for NetBIOS enumeration: While Nmap is a powerful tool, the specific mention of NetBIOS enumeration via NSE may not guarantee the necessary compatibility with IPv6 implementations, and existing scripts might not adequately handle the nuances of IPv6 networking.
In conclusion, identifying the correct enumeration tool that explicitly accommodates IPv6 is paramount for comprehensive network analysis.
References:
https://www.cisco.com/c/en/us/support/docs/ip/ipv6/137404-56.html https://www.microsoft.com/en-us/security/blog/2019/03/12/what-is-ntlm-and-how-does-it-work/ https://nmap.org/nse/


Reference:

References:
https://www.cisco.com/c/en/us/support/docs/ip/ipv6/137404-56.html https://www.microsoft.com/en-us/security/blog/2019/03/12/what-is-ntlm-and-how-does-it-work/ https://nmap.org/nse/



During a red team assessment, a CEH is given a task to perform network scanning on the target network without revealing its IP address. They are also required to find an open port and the services available on the target machine.
What scanning technique should they employ, and which command in Zenmap should they use?

  1. Use SCTP INIT Scan with the command "-sY"
  2. Use UDP Raw ICMP Port Unreachable Scanning with the command "-sU"
  3. Use the ACK flag probe scanning technique with the command "-sA"
  4. Use the IDLE/IPID header scan technique with the command "-sI"

Answer(s): D

Explanation:

D is correct because the IDLE/IPID header scan technique allows for stealthy reconnaissance by leveraging a third party to infer targets' responses without revealing the scanning host's IP address.
Justification for the Correct Option
The IDLE/IPID scan operates by sending packets to the target through a zombie host. The zombie’s IPID sequence number is monitored to determine if a port is open or closed, effectively masking the attacker's identity. This technique ensures that the red team can perform network scanning silently while identifying open ports and services on the target machine.
Critique of Other Options

A: SCTP INIT Scan with the command "-sY" This option is unsuitable as SCTP scans are less common and primarily focused on the Stream Control Transmission Protocol, which might not apply in many environments. Furthermore, SEC-based scans do not inherently provide anonymity as the original IP would still be visible.
B: UDP Raw ICMP Port Unreachable Scanning with the command "-sU" While this method can identify open UDP ports, it does not offer a stealthy approach. The source IP of the scan will be exposed, compromising the requirement to remain undetectable during the assessment. Additionally, UDP scanning is often more prone to filtering or blocking by firewalls.
C: ACK Flag Probe Scanning with the command "-sA" ACK scans are typically used to analyze firewall rulesets rather than identify open ports. This method exposes the originating IP address, directly conflicting with the requirement of maintaining anonymity. ACK scans also primarily deduce whether ports are filtered or unfiltered rather than specifically reporting what services are available.


Reference:

https://nmap.org/book/man.html https://www.cissp.com/ethical-hacking-scanning-techniques/ https://www.sans.org/white-papers/41757/



A large corporation is planning to implement preventive measures to counter a broad range of social engineering techniques. The organization has implemented a signature-based IDS, intrusion detection system, to detect known attack payloads and network flow analysis to monitor data entering and leaving the network. The organization is deliberating on the next step. Considering the information provided about various social engineering techniques, what should be the organization's next course of action?

  1. Implement endpoint detection and response solution to oversee endpoint activities
  2. Set up a honeypot to attract potential attackers into a controlled environment for analysis
  3. Deploy more security personnel to physically monitor key points of access
  4. Organize regular employee awareness training regarding social engineering techniques and preventive measures

Answer(s): D

Explanation:

Organizing regular employee awareness training regarding social engineering techniques and preventive measures (Option D) is the most effective next step for the organization to combat social engineering threats.
Employee awareness training directly addresses the human element of security, which is often the weakest link in any cybersecurity strategy. Research has consistently shown that social engineering exploits the vulnerabilities of individuals rather than technical weaknesses in systems. By educating employees about common social engineering tactics such as phishing, pretexting, and baiting, the organization fosters a culture of vigilance and responsibility, enabling individuals to recognize and appropriately respond to potential threats (Davis, 2022). This proactive measure not only mitigates risks but also empowers employees to act as the first line of defense against such attacks (Sullivan et al., 2021). Moreover, frequent training sessions mimic the perpetually evolving tactics of attackers, necessitating regular updates to knowledge and best practices.
Evaluation of Other Options:

A: Implement endpoint detection and response solution to oversee endpoint activities: While this solution enhances the technical defenses of the organization, it focuses more on system-level security rather than addressing the behavioral risks posed by social engineering. This fails to mitigate the primary threat vector, which is human vulnerability.
B: Set up a honeypot to attract potential attackers into a controlled environment for analysis: Although honeypots can be useful for studying attacker behavior and improving overall security measures, they do not directly educate or protect employees from social engineering attacks. This method may be resource-intensive and does not prevent incidents that could occur before attackers are lured in.
C: Deploy more security personnel to physically monitor key points of access: Increased physical security can deter unauthorized personnel but does not address social engineering attacks that typically exploit psychological tactics rather than physical breaches. This measure may create a false sense of security and distract from necessary education and awareness efforts.
In conclusion, continuous education is vital in raising awareness and preparing employees to resist social engineering attacks effectively.
References:
https://www.securitymagazine.com/articles/92136-creating-an-effective-employee-awareness-training-program https://www.csoonline.com/article/3531062/why-security-awareness-training-is-critical-to-your-companys-defense.html https://www.cybersecuritydive.com/news/security-awareness-training-how-to-do-it-right/604721/


Reference:

References:
https://www.securitymagazine.com/articles/92136-creating-an-effective-employee-awareness-training-program https://www.csoonline.com/article/3531062/why-security-awareness-training-is-critical-to-your-companys-defense.html https://www.cybersecuritydive.com/news/security-awareness-training-how-to-do-it-right/604721/



An audacious attacker is targeting a web server you oversee. He intends to perform a Slow HTTP POST attack, by manipulating 'a' HTTP connection. Each connection sends a byte of data every 'b' second, effectively holding up the connections for an extended period. Your server is designed to manage 'm' connections per second, but any connections exceeding this number tend to overwhelm the system. Given 'a=100' and variable 'm', along with the attacker's intention of maximizing the attack duration 'D=a*b', consider the following scenarios.
Which is most likely to result in the longest duration of server unavailability?

  1. m=90, b=15: The server can manage 90 connections per second, but the attacker's 100 connections exceed this, and with each connection held up for 15 seconds, the attack duration could be significant.
  2. m=105, b=12: The server can manage 105 connections per second, more than the attacker's 100 connections, likely maintaining operation despite a moderate hold-up time.
  3. m=110, b=20: Despite the attacker sending 100 connections, the server can handle 110 connections per second, therefore likely staying operative, regardless of the hold-up time per connection.
  4. m=95, b=10: Here, the server can handle 95 connections per second, but it falls short against the attacker's 100 connections, albeit the hold-up time per connection is lower.

Answer(s): A

Explanation:

A is correct because the scenario with m=90 and b=15 demonstrates a situation where the attacker exceeds the server's connection capacity, significantly prolonging server unavailability.
In evaluating the attack scenarios:
1. Scenario A (m=90, b=15) : The server's capacity of 90 connections per second is outstripped by the attacker's 100 connections. The duration of contention is calculated as ( D = a \times b = 100 \times 15 = 1500 ) seconds. This immense duration significantly disrupts server availability.
2. Scenario B (m=105, b=12) : The server can handle 105 connections, exceeding the attacker's 100. As a result, the server maintains operational capacity, and the hold-up is limited to the duration of legitimate traffic rather than being overwhelmed, effectively incurring negligible downtime.
3. Scenario C (m=110, b=20) : Similar to Scenario B, the server can manage 110 connections against the attacker's 100. The additional capacity allows the server to effectively mitigate the attack, leading to minimal disruption. The high hold-up time of 20 seconds does not impact overall unavailability.
4. Scenario D (m=95, b=10) : Although the server's capacity is only slightly short of the attacker's connections, allowing for 95 against 100, the decreased hold-up time of 10 seconds results in reduced duration. However, since the server is still overwhelmed, extended unavailability can occur.
In conclusion, A is the most detrimental scenario due to the substantial overlap of connection requests and extended hold-up time, further complicating server responsiveness.
References:
https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/ https://owasp.org/www-community/Slow_HTTP_Requests https://www.cloudflare.com/learning/ddos/glossary/slow-http-attack/


Reference:

References:
https://www.eccouncil.org/programs/certified-ethical-hacker-ceh/ https://owasp.org/www-community/Slow_HTTP_Requests https://www.cloudflare.com/learning/ddos/glossary/slow-http-attack/



A large organization has recently performed a vulnerability assessment using Nessus Professional, and the security team is now preparing the final report. They have identified a high-risk vulnerability, named XYZ, which could potentially allow unauthorized access to the network. In preparing the report, which of the following elements would NOT be typically included in the detailed documentation for this specific vulnerability?

  1. Proof of concept (PoC) of the vulnerability, if possible, to demonstrate its potential impact on the system.
  2. The total number of high, medium, and low-risk vulnerabilities detected throughout the network.
  3. The list of all affected systems within the organization that are susceptible to the identified vulnerability.
  4. The CVE ID of the vulnerability and its mapping to the vulnerability's name, XYZ.

Answer(s): B

Explanation:

B is correct because the total number of vulnerabilities across various risk levels is not directly relevant to the specific high-risk vulnerability, XYZ, that is being assessed.
Reasoning for B: In vulnerability assessment reports, the focus is on the specifics of the identified vulnerabilities. Including a statistical summary of all vulnerabilities dilutes the emphasis on critical risks that require immediate attention. The goal of highlighting high-risk vulnerabilities is to guide remediation efforts, necessitating detailed insights rather than broad statistics.
Critical Evaluation of Other Options:

A: Proof of concept (PoC): This is essential for demonstrating the exploitability of the vulnerability. A PoC provides a tangible example that can clarify the risk and help stakeholders understand the urgency of remediation. It serves as a crucial tool for technical teams to assess the potential impact on the organization.
C: Affected systems list: Identifying which systems are susceptible to the vulnerability is critical for prioritizing remediation efforts. This targeted information allows the security team to focus on the most critical assets and implement necessary controls effectively, facilitating a risk-based approach to security management.
D: CVE ID: The Common Vulnerabilities and Exposures (CVE) identifier is crucial for referencing vulnerabilities across platforms and tools. Including the CVE ID enhances the report’s credibility and aids in the information-sharing process, enabling the security team to cross-reference with existing resources and understand the vulnerability in the broader cybersecurity context.
In summary, while B provides a general overview, it lacks the precision necessary for addressing a specific high-risk vulnerability, making it less relevant in focused vulnerability assessment documentation.
References:
https://www.nessus.com https://cve.mitre.org https://owasp.org


Reference:

References:
https://www.nessus.com https://cve.mitre.org https://owasp.org



Recently, the employees of a company have been receiving emails that seem to be from their colleagues, but with suspicious attachments.
When opened, these attachments appear to install malware on their systems. The IT department suspects that this is a targeted malware attack.
Which of the following measures would be the most effective in preventing such attacks?

  1. Disabling Autorun functionality on all drives
  2. Avoiding the use of outdated web browsers and email software
  3. Regularly scan systems for any new files and examine them
  4. Applying the latest patches and updating software programs

Answer(s): C

Explanation:

C is correct because regularly scanning systems for new files can detect and mitigate the effects of targeted malware attacks effectively.
The rationale for selecting C centers on proactive monitoring and risk management. By regularly scanning systems, organizations can identify unauthorized changes or suspicious files introduced by malware before they can propagate or cause damage. This practice aligns with the principle of defense-in-depth, enhancing the overall security posture by enabling the detection and containment of malicious activities.
Evaluation of Incorrect Options:

A: Disabling Autorun functionality on all drives While disabling Autorun can mitigate infections from removable media, it does not address malware introduced through email attachments, the primary vector in this scenario. Thus, it offers limited protection compared to the proactive approach detailed in C.
B: Avoiding the use of outdated web browsers and email software Although ensuring software is up-to-date is foundational for security, outdated browsers and email clients are not the sole sources of malware. Employees can still open harmful attachments from colleagues regardless of their browser's state, making this measure insufficient in the context of targeted email attacks.
D: Applying the latest patches and updating software programs Keeping software updated is crucial as it can close vulnerabilities that malware exploits. However, timely patch management alone does not guarantee immediate detection of malware already present on systems. This option fails to encompass the need for continuous monitoring and targeted scans specifically against unsolicited attachments.
In conclusion, employing a strategy that incorporates regular scanning for unauthorized files ensures that organizations can respond swiftly to emerging threats, outweighing the limitations of the other options.


Reference:

https://www.cisecurity.org/white-papers/importance-of-continuous-monitoring-and-detection " target="_blank"> https://www.cisecurity.org/white-papers/importance-of-continuous-monitoring-and-detection https://www.nist.gov/publications/guide-incident-response-and-management " target="_blank"> https://www.nist.gov/publications/guide-incident-response-and-management https://www.sans.org/white-papers/3762/
" target="_blank"> https://www.sans.org/white-papers/3762/



A network security analyst, while conducting penetration testing, is aiming to identify a service account password using the Kerberos authentication protocol. They have a valid user authentication ticket (TGT) and decided to carry out a Kerberoasting attack. In the scenario described, which of the following steps should the analyst take next?

  1. Carry out a passive wire sniffing operation using Internet packet sniffers
  2. Perform a PRobability INfinite Chained Elements (PRINCE) attack
  3. Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz
  4. Request a service ticket for the service principal name of the target service account

Answer(s): D

Explanation:

D is correct because it involves requesting a service ticket for the service principal name (SPN) of the target service account, which is a crucial step in executing a Kerberoasting attack.
In a Kerberoasting attack, the attacker seeks to obtain service tickets associated with SPNs to extract encrypted passwords, which can then be subjected to offline cracking attempts. By making a request for a service ticket, the analyst engages the Kerberos Ticket Granting Service, enabling the acquisition of the ticket needed to extract the service credentials.
Evaluation of Incorrect Options:

A: Carry out a passive wire sniffing operation using Internet packet sniffers: While passive sniffing can collect various network traffic data, it does not directly contribute to the objectives of a Kerberoasting attack, which focuses on obtaining service tickets specifically designed for offline cracking.
B: Perform a PRobability INfinite Chained Elements (PRINCE) attack: This option is irrelevant to Kerberoasting as PRINCE is a specific cryptanalysis technique unrelated to the exploitation of service tickets or the Kerberos protocol.
C: Extract plaintext passwords, hashes, PIN codes, and Kerberos tickets using a tool like Mimikatz: Although Mimikatz can effectively extract credentials, the relevant phase in a Kerberoasting attack focuses on acquiring service tickets first; without these tickets, Mimikatz would lack the necessary data to operate effectively.
Overall, option D aligns with the tactical objective of the Kerberoasting method by facilitating access to encrypted passwords necessary for later decryption.
References:
https://www.csoonline.com/article/3243311/what-is-kerberoasting-and-how-can-you-prevent-it.html https://www.troyhunt.com/what-is-kerberoasting-and-how-it-works/ https://www.pentestmag.com/what-is-kerberoasting-in-penetration-testing/


Reference:

References:
https://www.csoonline.com/article/3243311/what-is-kerberoasting-and-how-can-you-prevent-it.html https://www.troyhunt.com/what-is-kerberoasting-and-how-it-works/ https://www.pentestmag.com/what-is-kerberoasting-in-penetration-testing/



  PDF
Viewing page 20 of 133
Viewing questions 153 - 160 out of 1065 questions


Post your Comments and Discuss EC-Council 312-50v13 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!